3
0
mirror of https://github.com/ergochat/ergo.git synced 2024-11-22 11:59:40 +01:00
Commit Graph

18 Commits

Author SHA1 Message Date
Shivaram Lingamneni
9589d019cb fix a DoS against websocket clients
I assumed gorilla validated UTF8 for incoming text messages. In fact, the
documentation states:

>It is the application's responsibility to ensure that text messages
>are valid UTF-8 encoded text.

and this applies to both incoming and outgoing messages. Consequently,
even when enforce-utf8 is enabled, it was possible to send invalid UTF8
to Ergo inside a websocket text frame. This data would be incorrectly
considered valid UTF8, and could be relayed to other clients, including
to websocket clients inside a text frame. The resulting frame would violate
the websocket protocol, causing web clients to be disconnected.
2023-01-22 14:58:43 -05:00
Shivaram Lingamneni
4910aefa37 use ergochat/irc-go instead of goshuirc/irc-go 2021-06-18 02:43:25 -04:00
Shivaram Lingamneni
23c7218bf1 first pass at renaming Oragono to Ergo 2021-05-26 15:55:24 -04:00
Shivaram Lingamneni
7c5a8f2013 make MaxLineLen configurable 2021-05-24 00:38:47 -04:00
Shivaram Lingamneni
131eb229bc use the new irc-go identifiers 2021-03-10 20:07:43 -05:00
Shivaram Lingamneni
e9d42e02a2 simplify utf8 validation of incoming WS lines
As of #1483, websockets entail enforce-utf8, so there's no need
to check globalUTF8EnforcementSetting when handling websockets.
2021-02-26 03:10:30 -05:00
Shivaram Lingamneni
d547d05205 implement candidate compromise proposal for websockets
1. Text and binary frames are accepted
2. Text frames are sent by default
3. Binary frames are sent to clients who negotiate `binary.ircv3.net`
4. Non-UTF8 data is not accepted (enabling websockets still enables UTFONLY)
2021-02-24 14:08:04 -05:00
Shivaram Lingamneni
d0e11f49ad use the new goshuirc ircreader 2021-02-13 20:58:19 -05:00
Shivaram Lingamneni
bb5276553d initial UBAN implementation 2021-01-19 08:49:45 -05:00
Shivaram Lingamneni
db81b15acb initial work on #1483
Add the new utf8-only cap, disallow non-utf8 when websockets are enabled
2021-01-15 06:19:13 -05:00
Shivaram Lingamneni
c78253fd93 more memory-efficient implementation of line reading 2020-08-07 01:10:46 -04:00
Shivaram Lingamneni
aad39024b9 mitigate a potential DoS against websocket listeners
Websocket listeners would process an arbitrary number of invalid
(non-text or blank) messages without throttling. This imposes fakelag
on such messages by treating them as blank lines.
2020-08-05 15:00:39 -04:00
Shivaram Lingamneni
15c54e80de clean up some error handling 2020-08-03 23:57:42 -04:00
Shivaram Lingamneni
6a2fba9812 make it easier to patch out the maximum line length 2020-08-03 12:51:04 -04:00
Shivaram Lingamneni
8cadc7340a don't trim line endings in IRCStreamConn
Doesn't help if the line ends with regular \n only,
and the parser has to account for \r and \n anyway
2020-06-23 03:25:20 -04:00
Shivaram Lingamneni
a4f9e08a85 fix #1151 2020-06-22 15:50:28 -04:00
Shivaram Lingamneni
c92192ef48 review fixes; add submatch support to glob 2020-05-05 17:20:55 -04:00
Shivaram Lingamneni
3dc5c8de78 more work on websocket support 2020-05-04 23:26:51 -04:00